From 986d9d08efd59264b20e4e0e580d006c34f9a1721b5f5aeef2147adfd1b948ef Mon Sep 17 00:00:00 2001
From: Reinhard Max <max@suse.com>
Date: Thu, 20 Feb 2025 16:33:34 +0000
Subject: [PATCH] - Upgrade to 14.17:   * Improve behavior of libpq's quoting
 functions:     The changes made for CVE-2025-1094 had one serious oversight: 
    PQescapeLiteral() and PQescapeIdentifier() failed to honor     their
 string length parameter, instead always reading to the     input string's
 trailing null. This resulted in including     unwanted text in the output, if
 the caller intended to     truncate the string via the length parameter. With
 very bad     luck it could cause a crash due to reading off the end of    
 memory.     In addition, modify all these quoting functions so that when    
 invalid encoding is detected, an invalid sequence is     substituted for just
 the first byte of the presumed     character, not all of it. This reduces the
 risk of problems     if a calling application performs additional processing
 on     the quoted string.   * Fix small memory leak in pg_createsubscriber.  
 * https://www.postgresql.org/docs/release/14.17/   *
 https://www.postgresql.org/about/news/p-3018/

OBS-URL: https://build.opensuse.org/package/show/server:database:postgresql/postgresql14?expand=0&rev=85
---
 postgresql-14.16.tar.bz2        |  3 ---
 postgresql-14.16.tar.bz2.sha256 |  1 -
 postgresql-14.17.tar.bz2        |  3 +++
 postgresql-14.17.tar.bz2.sha256 |  1 +
 postgresql14.changes            | 23 +++++++++++++++++++++++
 postgresql14.spec               |  2 +-
 6 files changed, 28 insertions(+), 5 deletions(-)
 delete mode 100644 postgresql-14.16.tar.bz2
 delete mode 100644 postgresql-14.16.tar.bz2.sha256
 create mode 100644 postgresql-14.17.tar.bz2
 create mode 100644 postgresql-14.17.tar.bz2.sha256

diff --git a/postgresql-14.16.tar.bz2 b/postgresql-14.16.tar.bz2
deleted file mode 100644
index 81051af..0000000
--- a/postgresql-14.16.tar.bz2
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:673c26f15ebb14306ad0ea051d8acfb3915dd342de942f5b502e5354a0ab760c
-size 22491073
diff --git a/postgresql-14.16.tar.bz2.sha256 b/postgresql-14.16.tar.bz2.sha256
deleted file mode 100644
index a4aa164..0000000
--- a/postgresql-14.16.tar.bz2.sha256
+++ /dev/null
@@ -1 +0,0 @@
-673c26f15ebb14306ad0ea051d8acfb3915dd342de942f5b502e5354a0ab760c  postgresql-14.16.tar.bz2
diff --git a/postgresql-14.17.tar.bz2 b/postgresql-14.17.tar.bz2
new file mode 100644
index 0000000..39c99d1
--- /dev/null
+++ b/postgresql-14.17.tar.bz2
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:6ce0ccd6403bf7f0f2eddd333e2ee9ba02edfa977c66660ed9b4b1057e7630a1
+size 22488812
diff --git a/postgresql-14.17.tar.bz2.sha256 b/postgresql-14.17.tar.bz2.sha256
new file mode 100644
index 0000000..3e70e22
--- /dev/null
+++ b/postgresql-14.17.tar.bz2.sha256
@@ -0,0 +1 @@
+6ce0ccd6403bf7f0f2eddd333e2ee9ba02edfa977c66660ed9b4b1057e7630a1  postgresql-14.17.tar.bz2
diff --git a/postgresql14.changes b/postgresql14.changes
index c82e9f4..2eb7a59 100644
--- a/postgresql14.changes
+++ b/postgresql14.changes
@@ -1,3 +1,26 @@
+-------------------------------------------------------------------
+Tue Feb 18 11:36:44 UTC 2025 - Reinhard Max <max@suse.com>
+
+- Upgrade to 14.17:
+  * Improve behavior of libpq's quoting functions:
+    The changes made for CVE-2025-1094 had one serious oversight:
+    PQescapeLiteral() and PQescapeIdentifier() failed to honor
+    their string length parameter, instead always reading to the
+    input string's trailing null. This resulted in including
+    unwanted text in the output, if the caller intended to
+    truncate the string via the length parameter. With very bad
+    luck it could cause a crash due to reading off the end of
+    memory.
+    In addition, modify all these quoting functions so that when
+    invalid encoding is detected, an invalid sequence is
+    substituted for just the first byte of the presumed
+    character, not all of it. This reduces the risk of problems
+    if a calling application performs additional processing on
+    the quoted string.
+  * Fix small memory leak in pg_createsubscriber.
+  * https://www.postgresql.org/docs/release/14.17/
+  * https://www.postgresql.org/about/news/p-3018/
+
 -------------------------------------------------------------------
 Tue Feb 11 14:27:58 UTC 2025 - Reinhard Max <max@suse.com>
 
diff --git a/postgresql14.spec b/postgresql14.spec
index b1e24bf..6474024 100644
--- a/postgresql14.spec
+++ b/postgresql14.spec
@@ -16,7 +16,7 @@
 #
 
 
-%define pgversion 14.16
+%define pgversion 14.17
 %define pgmajor 14
 %define buildlibs 0
 %define tarversion %{pgversion}